ASD ISM 0352 Secure volatile media by overwriting with random data
What it says
SECRET and TOP SECRET volatile media is sanitised by overwriting it at least once in its entirety with a random pattern followed by a read back for verification.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure SECRET and TOP SECRET media are made unreadable by overwriting with random data and verifying it.
This control is about making sure that digital storage devices which held SECRET or TOP SECRET information are completely wiped before being disposed of or reused. It matters because if someone gets hold of these devices, they might be able to retrieve sensitive data, putting your privacy and security at risk.
Free. Save your status, tasks and notes.
Why it matters
Failing to overwrite SECRET/TOP SECRET volatile media with random data and verify by read-back can leave recoverable remnants, leading to classified data exposure.
How to implement
The IT team should identify all volatile storage media that have been used to store SECRET or TOP SECRET information to ensure proper sanitisation.
This can be done by reviewing records of media use and conducting an inventory of devices.
System owners must develop a clear process for wiping storage media with random data.
They should create a step-by-step guide for the IT staff, specifying the use of a trusted software tool that overwrites the entire device with random data.
IT staff should be trained on how to perform and verify the data wiping process.
This should include a demonstration of running the wiping software and the steps for verification by reading the data back to ensure it's been properly overwritten.
Managers should establish a policy that mandates the documentation of every media sanitisation, including the date, the method used, and the person responsible.
This helps ensure accountability and traceability.
IT managers should conduct periodic reviews to ensure that the sanitisation process is being followed properly.
They can achieve this by randomly sampling devices that have been marked as sanitised and checking the logs for compliance.
Keep it running
Overwrite all volatile media at least once with a random pattern, then perform a full read-back verification and retain logs to prove sanitisation was completed successfully.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documented policy on media sanitisation: Request to see the procedures that outline handling and sanitisation of SECRET and TOP SECRET media.
Look at
Clear steps and responsibility assignments.
Good evidence
Includes a comprehensive document with dates and names of responsible parties.
- Check 2 of 5What an auditor asks for
Ask for
Records of training conducted for staff on media sanitisation techniques.
Look at
Attendance sheets or certifications.
Good evidence
Shows regularly updated training records and evidence that all relevant staff have attended.
- Check 3 of 5What an auditor asks for
Ask for
Them to explain the steps they follow to sanitise media and how they verify it's been done properly.
Good evidence
Includes specific software tools used and understanding of the verification process.
- Check 4 of 5What an auditor asks for
Ask for
To watch a demonstration of the media wiping process.
Look at
Whether the staff use the tools as documented and follow the steps accurately.
Good evidence
Observation shows strict adherence to the documented procedures.
- Check 5 of 5What an auditor asks for
Ask for
To see the logbook or digital records capturing all sanitised media.
Look at
Entries with media details, sanitisation date, method used, and staff details.
Good evidence
Record includes all relevant information and matches inventory records.
Mappings
Closest match in ISO/IEC 27001: A.7.10, Secure management of storage media, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.7.10.
ISM-0352 requires SECRET and TOP SECRET volatile media to be sanitised by overwriting the entire medium at least once with a random pattern and then performing a read-back verification. Annex A 7.10 covers secure management of storage media across its full lifecycle (acquisition, use, transport and disposal) in line with classification and handling requirements, which includes sanitisation expectations. ISM-0352 is a specific, high-assurance sanitisation method for a particular classification and media type, whereas Annex A 7.10 is broader lifecycle governance and handling.
This control partially meets A.7.14.
ISM-0352 mandates a specific sanitisation technique for SECRET and TOP SECRET volatile media: full overwrite with random data followed by verification. Annex A 7.14 requires equipment with storage media to be verified as having sensitive data removed or securely overwritten prior to disposal or re-use, which is the same end-goal of making data unrecoverable. ISM-0352 is narrower because it prescribes the overwrite-and-verify approach (and applies to volatile media and certain classifications), while Annex A 7.14 is broader and allows multiple secure removal methods and applies to disposal/re-use contexts generally.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.